BIT-GITLAB-2020-13354

A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: =12.6, 13.3.9...

BIT-GITLAB-2020-13355

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: =8.14, =13.4, =13.5, 13.5.2...

BIT-GITLAB-2020-13357

An issue was discovered in Gitlab CE/EE versions = 13.1 to = 13.5 to = 13.6 to 13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project...

BIT-GITLAB-2020-15525

GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...

BIT-GITLAB-2020-26406

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...

BIT-GITLAB-2020-26407

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project...

BIT-GITLAB-2020-6833

An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...

BIT-GITLAB-2020-7966

GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal...

BIT-GITLAB-2020-7967

GitLab EE 8.0 through 12.7.2 has Insecure Permissions issue 1 of 2...

BIT-GITLAB-2020-7971

GitLab EE 11.0 and later through 12.7.2 allows XSS...

BIT-GITLAB-2020-7972

GitLab EE 12.2 has Insecure Permissions issue 2 of 2...

BIT-GITLAB-2020-7974

GitLab EE 10.1 through 12.7.2 allows Information Disclosure...

BIT-GITLAB-2020-7976

GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control...

BIT-GITLAB-2020-7977

GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions...

BIT-GITLAB-2020-7979

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...

BIT-GITLAB-2020-8114

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...

BIT-GITLAB-2021-22169

An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages...

BIT-GITLAB-2021-22177

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command...

BIT-GITLAB-2021-22181

A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources...

BIT-GITLAB-2021-22189

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues...